Database/Kernel, userspace & hypervisor
Xen: race in viridian reference TSC page mapping frees a page still live in the guest p2m
Impact
A race in the mapping of the viridian reference TSC page lets a guest get Xen to free a page that is still present in the guest physical-to-machine (p2m) tables. This is the serious member of XSA-472: a freed page that remains guest-accessible is a path to writing memory the guest no longer owns, so host compromise or cross-guest impact cannot be ruled out, not just a crash. On a multi-tenant GPU host that means the isolation boundary between tenants sharing the machine - and the accelerators and fabric behind it - is in question. Treat this one as more than availability, even though the advisory stops short of a demonstrated escape.
Who can reach it
A local administrator inside an HVM guest with viridian enlightenments enabled, racing the hypervisor. No host credentials needed.
What to do
Patch the hypervisor per XSA-472 and reboot each host, draining or live-migrating guests first; this one is worth scheduling ahead of the two NULL dereferences in the same advisory. Where a window cannot be found quickly, disable viridian enlightenments on guests you do not fully trust.
References
Related entries
- Linux kernel libceph: unchecked length from the wire allows out-of-bounds writes in cephx authCVE-2025-68284 · Linux kernel libceph (handle_auth_session_key length validation)Critical
- Linux kernel libceph: use-after-free racing a monmap or osdmap update during CephFS mountCVE-2025-68285 · Linux kernel libceph (have_mon_and_osd_map monmap/osdmap locking)Critical
- Linux kernel crypto: AEAD algorithms using cra_reqsize get an uninitialized reqsize, corrupting memoryCVE-2025-68726 · Linux kernel crypto AEAD framework (request size initialization)Critical
- Linux kernel qla2xxx: wrong free of a pooled purex item on the PURLS error path corrupts memoryCVE-2025-68741 · Linux kernel qla2xxx (purex item freed with kfree instead of qla24xx_free_purex_item)Critical
- Linux kernel qla2xxx: commands leak after chip reset, and racing unmaps hit a BUG_ONCVE-2025-68745 · Linux kernel qla2xxx (command cleanup after chip reset)Critical
- Linux kernel iomap: length underflow on non-block-aligned reads returns a position past the folioCVE-2025-68794 · Linux kernel iomap (iomap_adjust_read_range block alignment)Critical
This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.